CVE-2021-24969

The Download Manager plugin for WordPress before version 3.2.22 fails to properly sanitize and escape template data when displaying it across multiple locations including the admin area and frontend pages. An authenticated attacker with subscriber-level permissions could exploit missing authorization and CSRF protections in the wpdm_save_template AJAX function to inject and execute malicious scripts.

Based on public CVE data (MITRE/NVD).